CVE-2023-2273 Rapid7 Insight Agent Directory Traversal

Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write...

ember-cli-broccoli-compass (>=0.0.1, <=0.0.5), ember-cli-compass (>=0.0.4, <=0.0.5) +1 more potentially affected by CVE-2023-27848 via broccoli-compass (>=0.0.7, <=0.1.1)

broccoli-compass NPM version =0.0.7, =0.0.1, =0.0.4, =0.0.1, =0.0.13 Source cves: CVE-2023-27848 Source advisory: OSV:GHSA-WQ8F-XMQ3-5VQ9...

Command injection

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series...

CVE-2023-27991

Zyxel vulnerability CVE-2023-27991 is a post-authentication command injection in the CLI of Zyxel firewall devices (ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, ZyWALL/USG) that could let an authenticated attacker execute OS commands remotely. Affected firmware ranges include ATP 4.32–5.35, ...

CVE-2023-27991

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series...

Fedora: Security Advisory for golang-github-cli-crypto (FEDORA-2023-cb20f08a4e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for golang-github-cli-gh (FEDORA-2023-cb20f08a4e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for golang-github-cli-oauth (FEDORA-2023-cb20f08a4e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: golang-github-cli-crypto-0-0.2.20230331git6be313f.fc37

GitHub's golang-crypto fork required for gh...

Cisco SD-WAN vManage Software Arbitrary File Deletion Vulnerability

A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could...

Authentication Bypass

org.apache.linkis:linkis-cli-application is vulnerable to Authentication Bypass. The vulnerability exists because the generated default tokens are easy to guess, which allows a remote attacker to bypass authentication mechanisms...

CVE-2023-28966

An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS Evolved allows a low-privileged local attacker with shell access to modify existing files or execute commands as root. The issue is caused by improper file and directory permissions on certain system files, allowing an...

CVE-2023-28961

An Improper Handling of Unexpected Data Type vulnerability in IPv6 firewall filter processing of Juniper Networks Junos OS on the ACX Series devices will prevent a firewall filter with the term 'from next-header ah' from being properly installed in the packet forwarding engine PFE. There is no...

Design/Logic Flaw

An Improper Handling of Unexpected Data Type vulnerability in IPv6 firewall filter processing of Juniper Networks Junos OS on the ACX Series devices will prevent a firewall filter with the term 'from next-header ah' from being properly installed in the packet forwarding engine PFE. There is no...

CVE-2023-28966 Junos OS Evolved: Local low-privileged user with shell access can execute CLI commands as root

An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS Evolved allows a low-privileged local attacker with shell access to modify existing files or execute commands as root. The issue is caused by improper file and directory permissions on certain system files, allowing an...

Juniper Networks Junos OS Evolved 安全漏洞

Juniper Networks Junos OS Evolved is an updated version of Juniper Networks' Junos OS. A security vulnerability exists in Juniper Networks Junos OS Evolved, which can be exploited by a local, low-privileged user with shell access to execute CLI commands as root, and affects the following products...

Fortinet Fortigate Ability to modify privileges from Custom to Read-Write (FG-IR-22-346)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-346 advisory. - An improper privilege management vulnerability CWE-269 in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy...

[SECURITY] Fedora 38 Update: podman-4.4.4-3.fc38

podman Pod Manager is a fully featured container engine that is a simple daemonless tool. podman provides a Docker-CLI comparable command line that eases the transition from other container engines and allows the management of pods, containers and images. Simply put: alias docker=3Dpodman. Most...

SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-2023:1844-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1844-1 advisory. Update aws-nitro-enclaves-cli to version 1.2.2git0.4ccc639: CVE-2022-31394: Fixed DoS vulnerability in hyper crate...

CVE-2023-29194

Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces...